Fears grow that age verification coming to VPNs as a British research firm labels them a 'loophole' — one app developer saw downloads surge by 1,800% in just the first month after the UK's Online Safety Act took effect

extract

Fears grow that age verification coming to VPNs as a British research firm labels them a 'loophole' — one app developer saw downloads surge by 1,800% in just the first month after the UK's Online Safety Act took effect The very tools regulators want to restrict are surging in popularity. The European Parliamentary Research Service (EPRS) published a briefing paper this week describing VPN use as "a loophole in the legislation that needs closing," as governments across Europe and the U.S. expand laws requiring platforms to verify users' ages before granting access to adult content. The paper noted that VPN downloads spiked after enforcement began in the UK and several U.S. states, with one app developer reporting an 1,800% increase in downloads in the first month following the UK's Online Safety Act taking effect last year. Some policymakers, including England's Children's Commissioner, have called for VPN services to be restricted to adults only. The EPRS paper acknowledges that current age-assurance methods are "relatively easy for minors to bypass," but offers no technical workaround to prevent VPN circumvention. In March, Utah became the first U.S. state to target VPN use in its age-verification law when Governor Spencer Cox signed Senate Bill 73. However, such efforts are technically flawed because the only reliable method for identifying VPN protocol signatures is deep packet inspection at the network level, which the EPRS paper doesn’t mention. VPN demand in Florida surged 1,150% within hours of Pornhub blocking access in that state, and Utah saw a 967% increase after a similar withdrawal. Mozilla, Mullvad, and Proton, among others, sent a joint letter opposing the UK's proposals to mandate age verification for VPN access on May 5th, urging officials “not to undermine the open internet.” The EPRS research paper comes less than a month after the EU’s own age verification technology, which European Commission President Ursula von der Leyen described as being built to respect “the highest privacy standards in the world — failed a basic security test. Security consultant Paul Moore found in April that the European Commission's official age verification app stored facial images from identity documents as unencrypted files and allowed its biometric authentication to be bypassed by toggling a single boolean value in a config file. Moore demonstrated a full bypass in under two minutes. The EPRS paper also highlights France's "double-blind" verification model, in which the adult platform learns only whether a user meets the age threshold, while the verification provider doesn’t see which sites the user visits. California has taken a separate approach, requiring operating systems to collect age data at device setup. GrapheneOS has refused to comply with such laws. Utah's law took effect on May 6th, defining a user's location as their physical presence, regardless of VPN use. The UK House of Lords voted 207-159 in January to ban VPN services for under-18s, while the EU Parliament adopted a resolution last November supporting a digital age of majority of 16 for social media. To date, the only governments that have made meaningful progress blocking VPN traffic are authoritarian regimes with ISP-level surveillance infrastructure. Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds. Get Tom's Hardware's best news and in-depth reviews, straight to your inbox. Luke James is a freelance writer and journalist. Although his background is in legal, he has a personal interest in all things tech, especially hardware and microelectronics, and anything regulatory. - LordVile My issue isn’t that they want ID, it’s that I have to give my ID to every company. It’s almost like digital ID would have solved this.Reply That being said I’d be happier giving my ID to someone like nord once than everyone else multiple times - Shiznizzle EU citizens have access to a government app that will dish out tokens to providers of content so no personal info needs to be given. This is an open source app but it was breached within hours. Fine, its in beta state and will eventually do as it should without leaking.....hopefully.Reply But for me this is even more sinister as the recipient of what i do is my own government. They are keeping tabs on what we do in the UK almost as good a china does with its citizens. No more nanny state. Is it the state's responsibility to decide who gets to use what app or do the parents have any responsibility for their kids at all? - Darrenmk Governments have proven many times that they cannot be trusted to protect the privacy of their people.Reply - chaos215bar2 Reply That's pretty inexcusable if so. But also not something I've seen reported elsewhere, so I doubt somewhat the seriousness of the "breach".Shiznizzle said:EU citizens have access to a government app that will dish out tokens to providers of content so no personal info needs to be given. This is an open source app but it was breached within hours. Security and cryptography are not things you leave for beta testing. They're things that needs to be designed correctly by experts in the field from the start, or the entire basis of your platform is a false promise. - Shiznizzle Reply I am so sorry. I was wrong. It was not two hours. It was two minuteschaos215bar2 said:That's pretty inexcusable if so. But also not something I've seen reported elsewhere, so I doubt somewhat the seriousness of the "breach". Security and cryptography are not things you leave for beta testing. They're things that needs to be designed correctly by experts in the field from the start, or the entire basis of your platform is a false promise. https://proton.me/blog/eu-age-verification-app-hacked https://www.google.com/search?q=EU+age+verification+app+breach&sca_esv=86d667622f42836f&source=hp&ei=E-T_afLML_mvhbIPu9Ou-Ac&iflsig=AFdpzrgAAAAAaf_yI1MCHeRVuLWKY435TFboVtjm-gBj&ved=0ahUKEwiyoruvza2UAxX5V0EAHbupC38Q4dUDCBY&uact=5&oq=EU+age+verification+app+breach&gs_lp=Egdnd3Mtd2l6Ih5FVSBhZ2UgdmVyaWZpY2F0aW9uIGFwcCBicmVhY2hI9FtQpRRY1llwBXgAkAEAmAFMoAG5CqoBAjMyuAEDyAEA-AEBmAIgoAKmCKgCCsICChAAGAMYjwEY6gLCAgoQLhgDGI8BGOoCwgIREC4YgAQYsQMYgwEYxwEY0QPCAg4QABiABBiKBRixAxiDAcICCxAAGIAEGLEDGIMBwgIOEC4YgAQYsQMYxwEY0QPCAgsQLhiABBixAxiDAcICBRAAGIAEwgIIEAAYgAQYsQPCAggQLhiABBixA8ICBBAAGAPCAgsQLhiABBjHARivAcICCxAuGIAEGMcBGNEDwgIGEAAYFhgewgILEAAYgAQYigUYhgPCAggQABiABBiiBJgDBPEF_RBlml5nBqqSBwIzMqAHiJ0BsgcCMje4B5wIwgcGMC4zMS4xyAcugAgB&sclient=gws-wiz